Media Disposal Guidelines

These guidelines are intended to support Purdue University Data Classification and Governance Policy (VII.B.6), as well as the Data Handling Requirements as issued by the University Data Stewards.

Disposal Guidelines for Paper-Based Media

The proper media disposal technique for any paper based documentation must match the highest classification of data that is contained in that document. Therefore, a document containing both University classified sensitive and restricted data must be disposed of in the manner required for the disposal of restricted data.

Existing Departmental Managers are responsible for overseeing paper-based document disposal in his or her area.

Destruction methods for paper-based documentation includes use of the Purdue University Confidential Material Recycling Program, and other methods such as shredding (cross-cut shredding is best), disintegration, incineration, and pulverization.

Disposal Guidelines for Electronic-Based Media

The proper media disposal technique for electronic storage devices depends whether or not the electronic storage media is being repurposed for University use.

Electronic Storage Devices Repurposed for University Use: If the physical media is going to be repurposed for University use, then the electronic storage device must be wiped with a multiple pass/DoD secure overwrite prior to being repurposed to another unit or area.

Electronic Storage Devices NOT Repurposed for University Use: If the physical media is not going to be repurposed for University use, then the electronic storage device must be physically destroyed.

Existing Departmental Managers are responsible for overseeing electronic storage device disposal in his or her area. This responsibility includes ensuring that appropriate multiple pass/DoD secure overwrites are properly completed and documented in the event that storage devices are repurposed for University use.

Multiple pass/DoD overwrite means to overwrite all addressable locations with a character, its complement, then a random character, and verify.

Physical destruction methods for electronic storage devices include use of the Purdue Recycling for the Future program. Other methods of physical destruction may be acceptable so long as the electronic storage device is destroyed and the data contained on that device may not be recovered by any means.

Issued 9/25/2006, revised 10/12/2011 (to update policy references), from Purdue University Security Officer's Group and IT Security & Privacy. Questions about these guidelines can be addressed to itap-securityhelp@purdue.edu.